Free Traffic Legal Advice

Anyone care to take that bet?

Quote

I'll save my losing bets for Cheltenham next week 

Subject: Formal Complaint – Demand for Full Response Under Code of Practice

Dear [Complaints Handler],

Firstly, thank you for confirming that the final “Penalty Notice” has been rightfully cancelled.

I may be misinterpreting, but the tone of your message somewhat suggests this is intended to serve as your formal response to my complaint. I’m sure I don’t need to remind you, but per Section 11.4 of the BPA/IPC Private Parking Sector Single Code of Practice:

“A full response to a complaint must be provided by the parking operator within 28 days of its receipt unless exceptional circumstances apply, in which case the complainant must be kept informed by the operator.”

To be clear, I wouldn’t expect you to “comment on internal processes and their outcomes”, as stated in your email, but I do expect a full and substantive reply to the serious concerns I raised. To summarise:

• Why are you, an unregulated private parking company, issuing fake “Penalty Notices” designed to mislead motorists into believing you possess statutory or criminal enforcement powers which you clearly do not?
• Why are you attempting to rely on Railway Byelaws to justify civil enforcement of minor parking indiscretions, despite knowing full well that such matters do not fall within the scope of criminal prosecution under Byelaw 24(1)?
• Why are you directing recipients to a private appeals process in circumstances where you are claiming a statutory breach? Appeals panels have no jurisdiction over alleged criminal offences.
• Why are you asserting that you have a legal basis to infer vehicle ownership from DVLA registered keeper data, when this is explicitly contradicted by the front page of the V5C and by DVLA guidance?
• Why are your communications inconsistent as to who you believe is liable—at times addressing the keeper, at other times the driver or “owner”—with no coherent explanation?
• Why are your communications inconsistent as to what contravention is even alleged to have taken place?
• What failing occurred that allowed your customer service team to ignore straightforward questions from a customer attempting to resolve the matter?
• Why do different members of your staff have conflicting views on what information it is appropriate to disclose to a customer?
• Given I was told that information was disclosed to me which "shouldn’t have been", what assurances can you provide that my personal data—and that of your other customers—is being handled lawfully and securely?
• On what lawful basis under the UK GDPR are you processing and storing my personal data?

Additionally, your use of the term “Penalty Notice”, coupled with the implied criminal consequences, is highly misleading. You are not a prosecuting authority, and your notice cannot be lawfully construed as anything more than a speculative civil invoice. Its presentation—suggesting legal obligation and criminal liability—appears to constitute a breach of Section 2 of the Fraud Act 2006, namely:

“False representation made dishonestly and with intent to make a gain or cause loss.”

In other words, this was an attempt at extortion by deception.

I therefore repeat: this matter is not closed. You remain under an obligation to respond properly to the complaint raised. If a complete response is not received within the statutory timeframe, I will escalate the matter to the BPA, the DVLA, and reserve the right to report it to the police as a matter of criminal fraud.

Yours sincerely,


[Full Name]
[Address]

Briefing Note: Misleading Use of “Penalty Notices” by Private Parking Companies on Railway Land – Urgent Clarification Required from the Department for Transport

To: [MP's Name]
From: [Your Name / Constituent of [Constituency]]
Date: [Insert Date]
Subject: Misuse of Statutory Language and Questionable Legal Authority by Private Parking Operators at Railway Car Parks

Summary

This briefing seeks your support in raising a Parliamentary Question to the Secretary of State for Transport concerning the apparent misuse of statutory language and implied criminal enforcement powers by private parking companies operating on railway land.

Despite the DfT's tacit acceptance of civil parking enforcement under Byelaw 14, private parking companies continue to issue documents styled as “Penalty Notices”, misleadingly implying they have the authority to impose statutory criminal fines under Byelaw 24(1) — authority which they do not possess. The Department’s own correspondence acknowledges this distinction, yet fails to correct the confusing and legally dubious language being used.

Legal Distinction: Byelaw 14 vs. Byelaw 24(1)

The Railway Byelaws permit two separate and legally distinct enforcement mechanisms:

1. Byelaw 14(4)(i): Permits civil, contractual charges for minor parking infractions, such as overstaying or failure to pay. These are essentially Parking Charge Notices (PCNs) issued under a contractual agreement between the motorist and the operator.

2. Byelaw 24(1): Grants power to prosecute offences under the byelaws in the Magistrates’ Court, resulting in criminal penalties. This route is reserved for serious or repeated breaches and must be initiated by the Train Operating Company or a body with explicit statutory delegation.

The Department for Transport has confirmed that it has no issue with operators issuing PCNs under Byelaw 14(1)-(3) as a civil mechanism for handling minor parking matters. However, the Department has not authorised private parking companies to act under Byelaw 24(1), nor has it suggested that such powers have been delegated to them.

Key Concerns

1. Misuse of the Term “Penalty”

The DfT’s own correspondence refers to these charges as “penalties” [sic], a term which normally implies statutory or criminal consequences. This introduces serious ambiguity, potentially misleading motorists into believing they are being fined under criminal law. In reality, these are civil charges, and using the word “penalty” is legally and ethically problematic.

2. No Statutory Basis for Criminal Enforcement by Operators

Nowhere in DfT guidance or byelaw structure is there any confirmation that a private operator may issue a Penalty Notice with criminal implications. Any such action would require formal delegation under Byelaw 24(1), which has not occurred. As such, any implication of criminal liability is unfounded and misleading.

3. Potential Breach of Law

Operators issuing these misleading notices are in breach of:

• The Fraud Act 2006 – Section 2: false representation made with intent to gain or cause loss
• The Consumer Protection from Unfair Trading Regulations 2008 – Regulation 5: misleading actions likely to cause transactional decisions
• The Companies Act 2006, if corporate identity is used in a way that falsely implies statutory authority

Additionally, the retention of monies paid under such notices in the operator’s private account — rather than remitting to the TOC or public purse — reinforces the view that these are private civil claims masquerading as criminal penalties.

4. Inappropriate Use of Appeals Processes

The DfT encourages operators to provide an independent appeals process (such as POPLA or the IAS), which is appropriate for civil PCNs but has no place in criminal enforcement. Criminal matters are subject to due process through the courts — not private appeals panels.

Conclusion

The DfT has blurred the lines between civil and criminal enforcement, allowing private companies to exploit that ambiguity. While the Department accepts civil charges under Byelaw 14(4)(i), it has failed to intervene where operators unlawfully imply statutory authority and criminal consequences, causing considerable public confusion and potential legal harm.

Proposed Parliamentary Question

I respectfully ask you to table the following question to the Secretary of State for Transport:

"To ask the Secretary of State for Transport whether he will clarify the Department's position on the enforcement of railway byelaws in car parks managed by private parking companies; specifically, whether he accepts that Byelaw 14(4)(i) authorises only civil contractual charges and not criminal penalties, and that any implication by private operators that they possess statutory authority to issue 'Penalty Notices' under Byelaw 24(1) without explicit delegation is misleading, unlawful, and potentially a breach of consumer and fraud legislation."

Alternatively, a follow-up could be:

"To ask the Secretary of State for Transport what steps his Department is taking to prevent private parking operators from misrepresenting civil Parking Charge Notices as statutory 'Penalty Notices' when enforcing railway byelaws; and whether he will review the Department’s communications to ensure that the term 'penalty' is not used in a way that conflates civil enforcement under Byelaw 14(4)(i) with criminal prosecution powers under Byelaw 24(1), for which private operators have no statutory authority."

Supporting Documents

Further examples of misleading “Penalty Notices,” as well as correspondence from the DfT acknowledging the contractual nature of Byelaw 14, can be provided upon request.

Thank you for your time and attention to this matter. I hope you will consider taking action to help restore clarity and protect motorists from deceptive practices.

Yours sincerely,

[Your Full Name]
[Your Address & Postcode] (to confirm constituency)
[Your Email / Phone (optional)]

Subject: Failure to Respond to Formal Complaint – Final Reminder Prior to Escalation

Dear [Complaints Handler / APCOA Complaints Department],

I am writing to express my deep dissatisfaction with your continued failure to properly address the formal complaint submitted on [insert date]. Your email of 22 March 2025—while acknowledging cancellation of the spurious “Penalty Notice”—did not even attempt to provide a full and substantive response to the serious matters raised.

I remind you once again that your obligations are clear. As per Section 11.4 of the BPA/IPC Private Parking Sector Single Code of Practice (PPSCoP):

“A full response to a complaint must be provided by the parking operator within 28 days of its receipt unless exceptional circumstances apply, in which case the complainant must be kept informed by the operator.”

No such full response has been received, and no justification has been offered for this delay. In the absence of any reasonable explanation, your failure to comply with both your own policy and the industry Code of Practice amounts to a flagrant disregard for accountability and transparency.

To be absolutely clear: this matter is not closed. You are under a continuing obligation to provide a detailed and point-by-point reply to the concerns I raised. Your attempt to offer a generic, dismissive response while hoping the issue would disappear has been noted and will not be accepted.

I will now allow a further 7 days for you to issue a complete and substantive response addressing all of the following:

• The basis on which you purport to issue “Penalty Notices” that imply criminal liability, despite being a private contractor with no statutory authority.
• The misuse of Byelaw 14 to pursue civil enforcement outside the scope of prosecution under Byelaw 24(1).
• The misleading reference to criminal sanctions and statutory enforcement powers in your correspondence.
• Your misuse and misinterpretation of DVLA keeper data in an attempt to establish liability.
• The contradictory and inconsistent statements made by your staff regarding the nature of the alleged contravention, the liable party, and the appeals process.
• The failure of your customer service agents to engage with basic queries or offer any clarity to the recipient of your demands.
• The apparent mishandling of personal data, including comments suggesting that information disclosed to me "shouldn’t have been," which raises significant concerns over your internal data governance and staff training.
• The lack of clarity on what alleged contravention occurred, and why no coherent explanation has ever been given.

If a full response is not received within 7 days, I will escalate this matter formally to the British Parking Association, the DVLA, and, where applicable, to the Information Commissioner's Office. I also reserve the right to report the matter to the police on the basis that your use of intimidating and misleading documents may constitute an offence under Section 2 of the Fraud Act 2006.

Let there be no doubt: this is not a matter that will simply be allowed to lapse. You are now on notice to comply with your obligations in full.

Yours sincerely,

[Your Name]
[Your Address]
[Reference number, if applicable]

Dear Sir/Madam,

RE: SUBJECT ACCESS REQUEST

I write to make a formal Subject Access Request in respect of my personal information. I am entitled to make this request under data protection laws. The request is made in accordance with section 45 of the Data Protection Act 2018 and Article 15 of the retained EU General Data Protection Regulation 2016/679 (UK GDPR). You can identify my records using the information which is listed below.

For clarity, this request is directed to APCOA Parking (UK) Ltd and all affiliated companies and data controllers within the APCOA group, including but not limited to:

– APCOA Parking (UK) Ltd
– APCOA Parking Holdings (UK) Ltd
– APCOA Facilities Management (UK) Ltd
– APCOA Parking Services Ltd
– APCOA Parking Group GmbH (as the parent company)
– Any other UK or EEA-based subsidiaries, affiliates, or contractors acting as data processors or controllers on behalf of the APCOA group

Requester (data subject) information

(a) Full name:
(b) Address:
(c) Email address:
(d) Telephone number:
(e) PCN number:
(f) VRM:

Requested information

(a) Copies of my personal data

I request that I am provided with full copies of all personal data relating to me which is held by the APCOA group as outlined above. I would prefer to receive an electronic copy of the requested information.

(b) Purpose of the processing

Please confirm within your response the purpose(s) for which my personal data was collected and processed by any part of the APCOA group.

(c) Categories of the data

Please confirm which categories of my personal data have been collected or processed by any APCOA group company.

(d) Sharing of the data

Please confirm which recipients (including any third parties) my personal data has been or may be disclosed to. This includes disclosure to debt collection agencies, solicitors, or international entities. Please also confirm whether any data has been transferred outside the UK and, if so, the applicable safeguards in place.

(e) Storage of the data

Please provide the applicable data retention periods, or if no specific period is available, the criteria used to determine such periods.

(f) Source of the data

Please confirm the original source(s) of the data held about me.

(g) Details about automated decision-making

Please advise whether any automated decision-making has taken place using my data and provide full details of the logic involved and potential effects of such decisions.

(h) Existence of my rights

Please confirm my rights in respect of this data, including the rights to rectification, erasure, restriction, and objection to processing.

Responding to my request

The above contains all necessary information in order for you to process my request and any delay by yourselves will not absolve you from providing me with the information within one calendar month of the date above as this is being sent to you as an attachment by email.

I believe that the information which has been requested should be readily available to you.

This request should not therefore fall within the legal definition of an excessive or manifestly unfounded request and should not attract any processing fee.

I would be grateful for your assistance in processing my request within the required one month period of your receipt.

Yours faithfully,

[Your Full Name]

Thank you for your patience whilst this has been investigated.

• Why are you, an unregulated private parking company, issuing fake “Penalty Notices” designed to mislead motorists into believing you possess statutory or criminal enforcement powers which you clearly do not?

APCOA operate under and are regulated by the British Parking Association (BPA) and agree to adhere to the sector single code of practice.

We can confirm that this Penalty Notice is issued as a civil matter. The penalty notice system is an established mechanism designed to address breaches of the railway byelaws in a way that is proportionate and fair. These notices are not intended to suggest criminal intent or prosecution at the outset but to offer the opportunity to resolve matters without escalation. Should the recipient fail to engage or resolve the matter, criminal enforcement under Byelaw 14(1) may be pursued.


• Why are you attempting to rely on Railway Byelaws to justify civil enforcement of minor parking indiscretions, despite knowing full well that such matters do not fall within the scope of criminal prosecution under Byelaw 24(1)?
•Additionally, your use of the term “Penalty Notice”, coupled with the implied criminal consequences, is highly misleading. You are not a prosecuting authority, and your notice cannot be lawfully construed as anything more than a speculative civil invoice. Its presentation—suggesting legal obligation and criminal liability—appears to constitute a breach of Section 2 of the Fraud Act 2006, namely:

“False representation made dishonestly and with intent to make a gain or cause loss.”


In other words, this was an attempt at extortion by deception.

The term “Penalty Notice” is used because the breach of railway byelaws, such as unauthorised parking, constitutes a potential statutory offence. This is entirely different from a private parking charge, as our notices pertain to statutory enforcement of the byelaws, which may involve criminal liability in some cases. The presentation of the notice reflects the legal process in place, and it has been reviewed and approved to ensure compliance with the applicable legal standards.


• Why are you directing recipients to a private appeals process in circumstances where you are claiming a statutory breach? Appeals panels have no jurisdiction over alleged criminal offences.

It is important to clarify that while the alleged breach may indeed involve a potential criminal offence under the railway byelaws, the appeals process we reference is an administrative review mechanism designed to ensure that the matter is properly investigated, and the correct party is held accountable.
In accordance with the enforcement procedures under Byelaw 14 of the Railway Byelaws, the appeals process is a non-judicial review that allows recipients to challenge the validity of the charge based on the circumstances surrounding the alleged breach. This process provides an opportunity for the train operating company or relevant authority to review whether the penalty notice was appropriately issued, and for any mitigating factors to be considered.
It is important to note that this appeals process does not alter or replace the statutory provisions under the byelaws. If the matter proceeds beyond the appeals stage, it may be referred for criminal prosecution if deemed necessary. The appeals process, therefore, acts as a preliminary step in ensuring that no unfair or incorrect penalties are applied, rather than replacing or overstepping the jurisdiction of the criminal justice system.
Any decision made by POPLA is only binding on the car park operator and therefore the use of this independent appeals service benefits the consumer/motorist.


• Why are you asserting that you have a legal basis to infer vehicle ownership from DVLA registered keeper data, when this is explicitly contradicted by the front page of the V5C and by DVLA guidance?
• Why are your communications inconsistent as to who you believe is liable—at times addressing the keeper, at other times the driver or “owner”—with no coherent explanation?

Our access to DVLA data is governed by the Keeper at Date of Event (KADOE) contract, which permits APCOA to request the registered keeper’s details for the purpose of enforcing parking terms and conditions or pursuing relevant offences.

While the V5C document does indicate that being the registered keeper is not proof of ownership in itself, there is a legal presumption that the registered keeper is the owner of the vehicle unless evidence to the contrary is provided. This is reflected in the Vehicle Excise and Registration Act 1994, which defines an “owner” as the person by whom the vehicle is kept. In the case of a registered vehicle, this is presumed to be the person in whose name the vehicle is registered.

Accordingly, when investigating a breach of the railway byelaws, and in the absence of any information suggesting otherwise, it is both reasonable and appropriate for us to correspond with the registered keeper as the presumed owner of the vehicle. Under contract law, only the driver can be liable as they are present when the parking contract is both offered and accepted. However, under the Railway Byelaws, it is made clear that the owner is the liable party.


• Why are your communications inconsistent as to what contravention is even alleged to have taken place?

The Penalty Notice clearly states that the Penalty Notice was issued for the offence of "Use of private car park without making a valid payment". Whilst payment was made for the parking session, the payment is deemed as invalid as the incorrect tariff was paid.

The ANPR systems captured the vehicle entering Bedford Station car park at 07:31:29 meaning that the full one day tariff of £11.30 was due, however, as payment was only made at 13:08:38 the incorrect tariff of £4.60 was paid due to the off peak tariff being activated at 10:00am.


• What failing occurred that allowed your customer service team to ignore straightforward questions from a customer attempting to resolve the matter?
• Why do different members of your staff have conflicting views on what information it is appropriate to disclose to a customer?

The chat transcripts have been reviewed by APCOA management and has been found to be below the high standards that APCOA work to. As a result, an internal investigation has been conducted and a conclusion is that the fails were due to insufficient training of the customer service agents who handled your queries. The agents involved have now been given the required additional training.

Whilst we’re unable to comment on internal processes and their outcomes, rest assured the level of customer service given to all customers, and the conduct of all APCOA staff is a top priority and as such, we are treating this matter extremely seriously.


APCOA would like to take this opportunity to thank you for bringing this to our attention and also offer our sincere apologies for the less than satisfactory level of customer service that you received on this occasion.



• Given I was told that information was disclosed to me which "shouldn’t have been", what assurances can you provide that my personal data—and that of your other customers—is being handled lawfully and securely?
• On what lawful basis under the UK GDPR are you processing and storing my personal data?

We can confirm that your personal data has been redacted from the below cases:


Please see below links to both APCOA's privacy policy and data protection policy which outline how APCOA handles your personal data.

APCOA Privacy Policy - https://www.apcoa.co.uk/privacy-policy/
APCOA Data Protection Policy - https://www.apcoa.co.uk/index.php?id=6296

If you have any concerns or queries relating to how APCOA have handled your details, you can contact our Data Protection Office via email on DPO@apcoa.com

Kind regards,
Complaints Handler
APCOA

Good Afternoon,

Thank you for your email to the Data Protection Office at APCOA Parking (UK).

Please complete the attached form and return in order that we can provide the requested information.

Please be advised that you are not obliged to complete this form to make a request, but it’s helpful for us to know what you’re looking for so we can respond fully and promptly. Although the completion of this form is not a requirement, proof of identification is still required. The timescale for responding to your request will start when we receive this.

Yours Sincerely,

Subject: Re: Subject Access Request – Reminder of Legal Obligations

Dear Data Protection Officer,

Thank you for your response dated [INSERT DATE].

While I appreciate the need for identity verification, I must remind you that this request was submitted in my capacity as the Keeper, and I have already corresponded with APCOA on this matter using the same name and address you originally obtained from the DVLA.

As such, you already have sufficient information to verify my identity. If you require confirmation, a copy of that prior correspondence can be provided to satisfy any reasonable verification requirement. However, requesting a V5C document is disproportionate in this context and not justified under Article 12(6) of the UK GDPR.

You are therefore reminded that:

• I submitted a valid Subject Access Request on [INSERT DATE].
• The 30-day statutory period began on that date, not from when you receive additional documents you arbitrarily demand.
• Your continued delay in responding may amount to a breach of the UK GDPR.

I expect the SAR to be processed without further obstruction. If no response is provided within the statutory timeframe, I will refer the matter to the Information Commissioner’s Office without further notice.

Yours sincerely,

[Your Name]